pqc-memory-mcp 1.0.0

package/dist/http.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+/**
+ * Streamable HTTP MCP entrypoint for remote clients (e.g. Claude.ai connectors).
+ *
+ * Requires:
+ *   PQC_TENANT_RESOLUTION_URL — pqc-api **public origin only** (e.g. https://crypticpqc.com); MCP calls
+ *   GET {origin}/api/v1/mcp/tenant-context. Bearer = pqc-api access JWT (HS256).
+ *
+ * Optional:
+ *   PORT — preferred on PaaS (Zeabur, Railway, Render); falls back to PQC_MCP_HTTP_PORT then 8787
+ *   PQC_MCP_SERVICE_API_KEY — forwarded as X-API-Key to tenant-context and mcp-exchange if set
+ *   PQC_MCP_AUTH0_EXCHANGE — off | 1/retry/true | always (see docs/mcp-auth0-exchange-contract.md)
+ *   PQC_MCP_ALLOWED_HOSTS — comma-separated host allowlist for DNS rebinding protection
+ *   PQC_MCP_PUBLIC_URL — public origin for OAuth protected resource metadata (e.g. https://mcp.example.com)
+ *   PQC_MCP_AUTHORIZATION_SERVERS — comma-separated issuer URLs for PRM (external IdP)
+ *   PQC_MCP_PRM_RESOURCE — optional RFC 9728 `resource` URL override (default: {PUBLIC_URL}/mcp). Must match Auth0 API Identifier if the client maps resource → audience.
+ *   PQC_TENANT_CONTEXT_MOCK=1 — dev only; uses PQC_API_* env as tenant for any bearer
+ *   PQC_MCP_DEBUG=1 — log HTTP + auth resolution steps (no secrets; token fingerprints only)
+ */
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { createPqcTenantVerifier } from "./auth/tenant-verifier.js";
+import { TenantRuntimeCache } from "./tenant-cache.js";
+import { createPqcMcpServer } from "./server-factory.js";
+import { isMcpDebug, mcpDebug } from "./debug.js";
+const resolutionUrl = process.env.PQC_TENANT_RESOLUTION_URL;
+const port = parseInt(process.env.PORT ?? process.env.PQC_MCP_HTTP_PORT ?? "8787", 10);
+const publicUrl = process.env.PQC_MCP_PUBLIC_URL?.replace(/\/$/, "");
+const authServersEnv = process.env.PQC_MCP_AUTHORIZATION_SERVERS;
+function parseAllowedHosts() {
+    const raw = process.env.PQC_MCP_ALLOWED_HOSTS;
+    if (!raw?.trim())
+        return undefined;
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+async function main() {
+    if (!resolutionUrl) {
+        console.error("PQC_TENANT_RESOLUTION_URL is required for HTTP MCP");
+        process.exit(1);
+    }
+    const cache = new TenantRuntimeCache();
+    const verifier = createPqcTenantVerifier(resolutionUrl);
+    const bearerAuth = requireBearerAuth({
+        verifier,
+        requiredScopes: [],
+    });
+    const app = createMcpExpressApp({
+        host: "0.0.0.0",
+        allowedHosts: parseAllowedHosts(),
+    });
+    if (isMcpDebug()) {
+        app.use((req, _res, next) => {
+            const pathOnly = (req.originalUrl || req.url || "").split("?")[0];
+            mcpDebug("http.request", {
+                method: req.method,
+                path: pathOnly,
+                host: req.headers.host ?? "",
+                hasAuthorization: Boolean(req.headers.authorization),
+            });
+            next();
+        });
+    }
+    const healthPayload = {
+        status: "ok",
+        service: "pqc-memory-mcp",
+        transport: "streamable-http",
+        mcp_post_path: "/mcp",
+        tenant_resolution: "configured",
+    };
+    app.get("/", (_req, res) => {
+        res.json({
+            ...healthPayload,
+            message: "MCP clients must use POST /mcp with Authorization: Bearer. This root URL is for humans and load balancers.",
+            links: { health: "/health", healthz: "/healthz", mcp: "POST /mcp" },
+        });
+    });
+    app.get("/health", (_req, res) => {
+        res.set("Cache-Control", "no-store");
+        res.json(healthPayload);
+    });
+    app.get("/healthz", (_req, res) => {
+        res.set("Cache-Control", "no-store");
+        res.json(healthPayload);
+    });
+    if (publicUrl && authServersEnv) {
+        const authorization_servers = authServersEnv
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        const resourceOverride = process.env.PQC_MCP_PRM_RESOURCE?.trim().replace(/\/$/, "");
+        const resource = resourceOverride || `${publicUrl}/mcp`;
+        app.get("/.well-known/oauth-protected-resource/mcp", (_req, res) => {
+            mcpDebug("oauth.prm.serve", {
+                resource,
+                authorization_servers_count: authorization_servers.length,
+            });
+            res.json({
+                resource,
+                authorization_servers,
+                scopes_supported: ["mcp:memory", "openid"],
+                bearer_methods_supported: ["header"],
+            });
+        });
+    }
+    app.post("/mcp", (req, _res, next) => {
+        mcpDebug("mcp.post.received", {
+            hasAuthorization: Boolean(req.headers.authorization),
+            contentType: String(req.headers["content-type"] ?? ""),
+        });
+        next();
+    }, bearerAuth, async (req, res) => {
+        mcpDebug("mcp.post.authenticated", {
+            contentType: String(req.headers["content-type"] ?? ""),
+            contentLength: String(req.headers["content-length"] ?? ""),
+        });
+        const server = createPqcMcpServer(async (extra) => {
+            const auth = (extra?.authInfo ?? req.auth);
+            if (!auth?.rawToken || !auth.tenantContext) {
+                throw new Error("Missing tenant context for tool execution");
+            }
+            return cache.getOrCreate(auth.rawToken, auth.tenantContext);
+        });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+        });
+        try {
+            await server.connect(transport);
+            res.on("close", () => {
+                void transport.close();
+                void server.close();
+            });
+            mcpDebug("mcp.post.streamable.handle_request");
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (error) {
+            mcpDebug("mcp.post.error", {
+                name: error instanceof Error ? error.name : "unknown",
+                message: error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200),
+            });
+            console.error("[pqc-memory] MCP HTTP error:", error);
+            if (!res.headersSent) {
+                res.status(500).json({
+                    jsonrpc: "2.0",
+                    error: { code: -32603, message: "Internal server error" },
+                    id: null,
+                });
+            }
+        }
+    });
+    // Browsers open /mcp with GET — return 200 so the deployment doesn’t look "broken".
+    // Real MCP traffic uses POST /mcp (see stateless Streamable HTTP examples).
+    app.get("/mcp", (_req, res) => {
+        res.set("Cache-Control", "no-store");
+        res.json({
+            service: "pqc-memory-mcp",
+            ok: true,
+            message: "Use POST /mcp with an MCP client (e.g. Claude connector). GET is only a sanity check.",
+            health: "/health",
+        });
+    });
+    app.delete("/mcp", (_req, res) => {
+        res.status(405).json({
+            jsonrpc: "2.0",
+            error: { code: -32000, message: "Method not allowed for DELETE" },
+            id: null,
+        });
+    });
+    app.listen(port, () => {
+        console.error(`[pqc-memory] Streamable HTTP MCP on port ${port} (POST /mcp)`);
+        if (isMcpDebug()) {
+            mcpDebug("http.boot", {
+                port,
+                tenantResolutionOrigin: resolutionUrl,
+                prmMounted: Boolean(publicUrl && authServersEnv),
+                auth0Exchange: (process.env.PQC_MCP_AUTH0_EXCHANGE || "off").trim() || "off",
+                hasServiceApiKey: Boolean(process.env.PQC_MCP_SERVICE_API_KEY),
+            });
+        }
+    });
+}
+main().catch((e) => {
+    console.error(e);
+    process.exit(1);
+});
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;AAC5D,MAAM,IAAI,GAAG,QAAQ,CACnB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,EAC3D,EAAE,CACH,CAAC;AACF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;AAEjE,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACnC,QAAQ;QACR,cAAc,EAAE,EAAE;KACnB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,mBAAmB,CAAC;QAC9B,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,iBAAiB,EAAE;KAClC,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,QAAQ,CAAC,cAAc,EAAE;gBACvB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;gBAC5B,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;aACrD,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,iBAAiB;QAC5B,aAAa,EAAE,MAAM;QACrB,iBAAiB,EAAE,YAAY;KAChC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5C,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,aAAa;YAChB,OAAO,EACL,4GAA4G;YAC9G,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE;SACpE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACnD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,qBAAqB,GAAG,cAAc;aACzC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,gBAAgB,IAAI,GAAG,SAAS,MAAM,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YACpF,QAAQ,CAAC,iBAAiB,EAAE;gBAC1B,QAAQ;gBACR,2BAA2B,EAAE,qBAAqB,CAAC,MAAM;aAC1D,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ;gBACR,qBAAqB;gBACrB,gBAAgB,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;gBAC1C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,IAAI,CACN,MAAM,EACN,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAClB,QAAQ,CAAC,mBAAmB,EAAE;YAC5B,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,EACD,UAAU,EACV,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpC,QAAQ,CAAC,wBAAwB,EAAE;YACjC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACtD,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,GAAG,CAAC,IAAI,CAA+B,CAAC;YACzE,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YAC/C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,gBAAgB,EAAE;gBACzB,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACrD,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACrF,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;oBACzD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;IAEF,oFAAoF;IACpF,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC/C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,gBAAgB;YACzB,EAAE,EAAE,IAAI;YACR,OAAO,EACL,uFAAuF;YACzF,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE;YACjE,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACpB,OAAO,CAAC,KAAK,CAAC,4CAA4C,IAAI,cAAc,CAAC,CAAC;QAC9E,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,WAAW,EAAE;gBACpB,IAAI;gBACJ,sBAAsB,EAAE,aAAa;gBACrC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC;gBAChD,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK;gBAC5E,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadTenantFromEnv } from "./tenant.js";
+import { TenantRuntime } from "./tenant-runtime.js";
+import { createPqcMcpServer } from "./server-factory.js";
+async function main() {
+    const tenant = loadTenantFromEnv();
+    const runtime = TenantRuntime.fromContext(tenant);
+    const server = createPqcMcpServer(async () => runtime);
+    process.on("SIGINT", async () => {
+        console.error("[pqc-memory] Shutting down...");
+        await runtime.sessionManager.close();
+        process.exit(0);
+    });
+    process.on("SIGTERM", async () => {
+        console.error("[pqc-memory] Shutting down...");
+        await runtime.sessionManager.close();
+        process.exit(0);
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("[pqc-memory] Server started (stdio)");
+}
+main().catch((error) => {
+    console.error("[pqc-memory] Fatal error:", error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IAEvD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/init-wizard.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function runInitWizard(): Promise<void>;
+//# sourceMappingURL=init-wizard.d.ts.map

package/dist/init-wizard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-wizard.d.ts","sourceRoot":"","sources":["../src/init-wizard.ts"],"names":[],"mappings":";AAyDA,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAgHnD"}

package/dist/init-wizard.js

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+/**
+ * Interactive MCP config merge: Cursor, Claude Code, or JetBrains Junie.
+ * All use the same server entry shape: { command, args, env } under mcpServers.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as readline from "node:readline/promises";
+function die(msg, rl) {
+    rl.close();
+    console.error(msg);
+    process.exit(1);
+}
+function configPathFor(host, scope) {
+    switch (host) {
+        case "cursor":
+            return scope === "global"
+                ? path.join(os.homedir(), ".cursor", "mcp.json")
+                : path.join(process.cwd(), ".cursor", "mcp.json");
+        case "claude":
+            return scope === "global"
+                ? path.join(os.homedir(), ".claude.json")
+                : path.join(process.cwd(), ".mcp.json");
+        case "junie":
+            return scope === "global"
+                ? path.join(os.homedir(), ".junie", "mcp", "mcp.json")
+                : path.join(process.cwd(), ".junie", "mcp", "mcp.json");
+    }
+}
+function hostLabel(host) {
+    switch (host) {
+        case "cursor":
+            return "Cursor";
+        case "claude":
+            return "Claude Code";
+        case "junie":
+            return "JetBrains Junie";
+    }
+}
+function nextSteps(host, configPath, serverName) {
+    const base = `\nDone.\n\n  Wrote: ${configPath}\n\nNext steps:\n`;
+    if (host === "cursor") {
+        return `${base}  • Fully quit and reopen Cursor (or Command Palette → “Reload Window”).\n  • Settings → Tools & MCP → confirm “${serverName}” appears.\n\nHelp: https://github.com/CascadiaTech/pqc-mcp-server\n`;
+    }
+    if (host === "claude") {
+        return `${base}  • Restart Claude Code (or reload MCP).\n  • Run /mcp to verify “${serverName}” is listed.\n  • Project scope uses .mcp.json — approve project prompts if asked.\n\nDocs: https://code.claude.com/docs/en/mcp\n`;
+    }
+    return `${base}  • Restart the IDE or Junie CLI.\n  • Use the /mcp command to confirm “${serverName}” (Junie CLI) or MCP Settings in the IDE.\n  • Project file: .junie/mcp/mcp.json; user file: ~/.junie/mcp/mcp.json\n\nDocs: https://junie.jetbrains.com/docs/junie-cli-mcp-configuration.html\n`;
+}
+export async function runInitWizard() {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    console.log(`
+╔══════════════════════════════════════════════════════════════╗
+║  pqc-memory-mcp — MCP setup (Cursor, Claude Code, or Junie)  ║
+╠══════════════════════════════════════════════════════════════╣
+║  Writes or merges mcpServers in the config file your client  ║
+║  reads. Secrets are stored in that file — do not commit       ║
+║  project files that contain API keys.                         ║
+╚══════════════════════════════════════════════════════════════╝
+`);
+    const hostAns = await rl.question("Which client?  [1] Cursor  [2] Claude Code  [3] JetBrains Junie  (default: 1): ");
+    const h = hostAns.trim();
+    const host = h === "2" ? "claude" : h === "3" ? "junie" : "cursor";
+    const scopeAns = await rl.question(`Save where?  [1] This project only  [2] Your user account (all projects)  (default: 1)\n` +
+        `  (${hostLabel(host)}: ${host === "cursor"
+            ? ".cursor/mcp.json vs ~/.cursor/mcp.json"
+            : host === "claude"
+                ? ".mcp.json vs ~/.claude.json"
+                : ".junie/mcp/mcp.json vs ~/.junie/mcp/mcp.json"}): `);
+    const scope = scopeAns.trim() === "2" ? "global" : "project";
+    const configPath = configPathFor(host, scope);
+    const defaultUrl = (process.env.PQC_API_URL || "https://crypticpqc.com").replace(/\/$/, "");
+    const urlIn = await rl.question(`pqc-db API URL (no trailing slash) [${defaultUrl}]: `);
+    const apiUrl = (urlIn.trim() || defaultUrl).replace(/\/$/, "");
+    const keyIn = await rl.question("API key (the pqc_… key — visible as you type; paste and press Enter): ");
+    const apiKey = keyIn.trim();
+    if (!apiKey)
+        die("API key is required.", rl);
+    const bucketIn = await rl.question("Memory bucket ID (UUID): ");
+    const bucketId = bucketIn.trim();
+    if (!bucketId)
+        die("Bucket ID is required.", rl);
+    const nameIn = await rl.question(`MCP server name [pqc-memory]: `);
+    const serverName = nameIn.trim() || "pqc-memory";
+    const methodAns = await rl.question("Start server how?  [1] npx -y pqc-memory-mcp (npm — default)  [2] node + absolute path to cli.js (local / .tgz): ");
+    const useLocal = methodAns.trim() === "2";
+    const env = {
+        PQC_API_URL: apiUrl,
+        PQC_API_KEY: apiKey,
+        PQC_BUCKET_ID: bucketId,
+    };
+    let command;
+    let args;
+    if (useLocal) {
+        const pIn = await rl.question("Absolute path to dist/cli.js (e.g. …/node_modules/pqc-memory-mcp/dist/cli.js): ");
+        const cliPath = pIn.trim();
+        if (!cliPath)
+            die("Path is required for local mode.", rl);
+        const resolved = path.resolve(cliPath);
+        if (!fs.existsSync(resolved))
+            die(`File not found: ${resolved}`, rl);
+        command = "node";
+        args = [resolved];
+    }
+    else {
+        command = "npx";
+        args = ["-y", "pqc-memory-mcp"];
+    }
+    rl.close();
+    let existing = {};
+    if (fs.existsSync(configPath)) {
+        try {
+            const raw = fs.readFileSync(configPath, "utf8");
+            existing = JSON.parse(raw);
+        }
+        catch {
+            console.error(`Could not parse JSON: ${configPath}`);
+            console.error("Move it aside or fix syntax, then run init again.");
+            process.exit(1);
+        }
+    }
+    const mcpServers = existing.mcpServers &&
+        typeof existing.mcpServers === "object" &&
+        !Array.isArray(existing.mcpServers)
+        ? { ...existing.mcpServers }
+        : {};
+    mcpServers[serverName] = {
+        command,
+        args,
+        env,
+    };
+    const out = { ...existing, mcpServers };
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, `${JSON.stringify(out, null, 2)}\n`, "utf8");
+    console.log(nextSteps(host, configPath, serverName));
+}
+//# sourceMappingURL=init-wizard.js.map

package/dist/init-wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-wizard.js","sourceRoot":"","sources":["../src/init-wizard.ts"],"names":[],"mappings":";AACA;;;GAGG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AAInD,SAAS,GAAG,CAAC,GAAW,EAAE,EAAsB;IAC9C,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,IAAU,EAAE,KAA2B;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;gBAChD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACtD,KAAK,QAAQ;YACX,OAAO,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5C,KAAK,OAAO;YACV,OAAO,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAU,EAAE,UAAkB,EAAE,UAAkB;IACnE,MAAM,IAAI,GAAG,uBAAuB,UAAU,mBAAmB,CAAC;IAClE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,GAAG,IAAI,mHAAmH,UAAU,sEAAsE,CAAC;IACpN,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,GAAG,IAAI,qEAAqE,UAAU,mIAAmI,CAAC;IACnO,CAAC;IACD,OAAO,GAAG,IAAI,2EAA2E,UAAU,iMAAiM,CAAC;AACvS,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtF,OAAO,CAAC,GAAG,CAAC;;;;;;;;CAQb,CAAC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC/B,iFAAiF,CAClF,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,IAAI,GAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEzE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAChC,0FAA0F;QACxF,MAAM,SAAS,CAAC,IAAI,CAAC,KACnB,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,QAAQ;gBACjB,CAAC,CAAC,6BAA6B;gBAC/B,CAAC,CAAC,8CACR,KAAK,CACR,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,UAAU,KAAK,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC7B,wEAAwE,CACzE,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;IAEjD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CACjC,mHAAmH,CACpH,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;IAE1C,MAAM,GAAG,GAA2B;QAClC,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,aAAa,EAAE,QAAQ;KACxB,CAAC;IAEF,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IAEnB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,iFAAiF,CAClF,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,mBAAmB,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAClC,CAAC;IAED,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACd,QAAQ,CAAC,UAAU;QACnB,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACjC,CAAC,CAAC,EAAE,GAAI,QAAQ,CAAC,UAAsC,EAAE;QACzD,CAAC,CAAC,EAAE,CAAC;IAET,UAAU,CAAC,UAAU,CAAC,GAAG;QACvB,OAAO;QACP,IAAI;QACJ,GAAG;KACJ,CAAC;IAEF,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC;IAExC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1E,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/mcp-exchange.d.ts

@@ -0,0 +1,38 @@
+export type McpExchangeTokenPayload = {
+    access_token: string;
+    refresh_token?: string;
+    expires_at: string | number;
+    token_type?: string;
+};
+/**
+ * POST /api/v1/auth/mcp-exchange — Auth0 access JWT → pqc-db TokenPair.
+ * Same X-API-Key as tenant-context when PQC_MCP_SERVICE_API_KEY is set.
+ */
+export declare function exchangeAuth0AccessToken(registrationBaseUrl: string, auth0AccessToken: string): Promise<McpExchangeTokenPayload>;
+export type CachedPqcJwt = {
+    accessToken: string;
+    expiresAtUnixSec: number;
+};
+type CacheEntry = {
+    accessToken: string;
+    expiresAtMs: number;
+};
+/**
+ * Caches pqc-db access JWT keyed by Auth0 token hash (Claude sends the same Auth0 token each request until refresh).
+ */
+export declare class McpExchangeTokenCache {
+    private readonly maxEntries;
+    private map;
+    constructor(maxEntries?: number);
+    getEntry(auth0Token: string): CacheEntry | null;
+    get(auth0Token: string): string | null;
+    /** Cached pqc-db JWT + expiry for MCP auth info (unix seconds). */
+    getCachedPqcJwt(auth0Token: string): CachedPqcJwt | null;
+    set(auth0Token: string, payload: McpExchangeTokenPayload): void;
+    invalidate(auth0Token: string): void;
+}
+export declare function getMcpExchangeCache(): McpExchangeTokenCache;
+/** True if JWT-shaped (three base64url segments); avoids POSTing opaque tokens to exchange. */
+export declare function looksLikeJwt(token: string): boolean;
+export {};
+//# sourceMappingURL=mcp-exchange.d.ts.map

package/dist/mcp-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-exchange.d.ts","sourceRoot":"","sources":["../src/mcp-exchange.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AA0BF;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,mBAAmB,EAAE,MAAM,EAC3B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,uBAAuB,CAAC,CA+ClC;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,KAAK,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;GAEG;AACH,qBAAa,qBAAqB;IAGpB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,OAAO,CAAC,GAAG,CAAiC;gBAEf,UAAU,GAAE,MAAkB;IAE3D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAW/C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAItC,mEAAmE;IACnE,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IASxD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAW/D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;CAGrC;AAID,wBAAgB,mBAAmB,IAAI,qBAAqB,CAK3D;AAED,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnD"}

package/dist/mcp-exchange.js

@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import { mcpDebug } from "./debug.js";
+import { resolutionApiOrigin, TenantResolveError } from "./tenant-fetch.js";
+const CACHE_MAX = 512;
+const SKEW_MS = 30_000;
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function parseExpiresAtMs(expiresAt) {
+    if (typeof expiresAt === "number" && Number.isFinite(expiresAt)) {
+        if (expiresAt > 1e12)
+            return expiresAt;
+        return expiresAt * 1000;
+    }
+    const s = String(expiresAt).trim();
+    const parsed = Date.parse(s);
+    if (!Number.isFinite(parsed)) {
+        return Date.now() + 3600_000;
+    }
+    return parsed;
+}
+/**
+ * POST /api/v1/auth/mcp-exchange — Auth0 access JWT → pqc-db TokenPair.
+ * Same X-API-Key as tenant-context when PQC_MCP_SERVICE_API_KEY is set.
+ */
+export async function exchangeAuth0AccessToken(registrationBaseUrl, auth0AccessToken) {
+    const base = resolutionApiOrigin(registrationBaseUrl);
+    const url = `${base}/api/v1/auth/mcp-exchange`;
+    const headers = {
+        Authorization: `Bearer ${auth0AccessToken}`,
+        "Content-Type": "application/json",
+    };
+    const serviceKey = process.env.PQC_MCP_SERVICE_API_KEY;
+    if (serviceKey) {
+        headers["X-API-Key"] = serviceKey;
+    }
+    mcpDebug("mcp_exchange.request", {
+        url,
+        hasServiceApiKey: Boolean(serviceKey),
+    });
+    const response = await fetch(url, { method: "POST", headers });
+    const data = (await response.json().catch(() => ({})));
+    if (!response.ok) {
+        const err = typeof data.error === "string" ? data.error : response.statusText || "mcp-exchange failed";
+        mcpDebug("mcp_exchange.response", {
+            url,
+            status: response.status,
+            ok: false,
+            errorSnippet: err.slice(0, 120),
+        });
+        throw new TenantResolveError(err, response.status);
+    }
+    const tokens = data.tokens;
+    if (!tokens?.access_token) {
+        mcpDebug("mcp_exchange.response", {
+            url,
+            status: response.status,
+            ok: false,
+            errorSnippet: "missing tokens.access_token",
+        });
+        throw new TenantResolveError("Invalid mcp-exchange response: missing tokens.access_token", 502);
+    }
+    mcpDebug("mcp_exchange.response", { url, status: response.status, ok: true });
+    return tokens;
+}
+/**
+ * Caches pqc-db access JWT keyed by Auth0 token hash (Claude sends the same Auth0 token each request until refresh).
+ */
+export class McpExchangeTokenCache {
+    maxEntries;
+    map = new Map();
+    constructor(maxEntries = CACHE_MAX) {
+        this.maxEntries = maxEntries;
+    }
+    getEntry(auth0Token) {
+        const key = hashToken(auth0Token);
+        const e = this.map.get(key);
+        if (!e)
+            return null;
+        if (Date.now() >= e.expiresAtMs - SKEW_MS) {
+            this.map.delete(key);
+            return null;
+        }
+        return e;
+    }
+    get(auth0Token) {
+        return this.getEntry(auth0Token)?.accessToken ?? null;
+    }
+    /** Cached pqc-db JWT + expiry for MCP auth info (unix seconds). */
+    getCachedPqcJwt(auth0Token) {
+        const e = this.getEntry(auth0Token);
+        if (!e)
+            return null;
+        return {
+            accessToken: e.accessToken,
+            expiresAtUnixSec: Math.floor(e.expiresAtMs / 1000),
+        };
+    }
+    set(auth0Token, payload) {
+        const key = hashToken(auth0Token);
+        const expiresAtMs = parseExpiresAtMs(payload.expires_at);
+        while (this.map.size >= this.maxEntries) {
+            const first = this.map.keys().next().value;
+            if (first === undefined)
+                break;
+            this.map.delete(first);
+        }
+        this.map.set(key, { accessToken: payload.access_token, expiresAtMs });
+    }
+    invalidate(auth0Token) {
+        this.map.delete(hashToken(auth0Token));
+    }
+}
+let sharedExchangeCache = null;
+export function getMcpExchangeCache() {
+    if (!sharedExchangeCache) {
+        sharedExchangeCache = new McpExchangeTokenCache();
+    }
+    return sharedExchangeCache;
+}
+/** True if JWT-shaped (three base64url segments); avoids POSTing opaque tokens to exchange. */
+export function looksLikeJwt(token) {
+    const parts = token.split(".");
+    return parts.length === 3 && parts.every((p) => p.length > 0);
+}
+//# sourceMappingURL=mcp-exchange.js.map

package/dist/mcp-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-exchange.js","sourceRoot":"","sources":["../src/mcp-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAa5E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,SAA0B;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,IAAI,SAAS,GAAG,IAAI;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,SAAS,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,mBAA2B,EAC3B,gBAAwB;IAExB,MAAM,IAAI,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,IAAI,2BAA2B,CAAC;IAE/C,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,gBAAgB,EAAE;QAC3C,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,sBAAsB,EAAE;QAC/B,GAAG;QACH,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC7F,QAAQ,CAAC,uBAAuB,EAAE;YAChC,GAAG;YACH,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,EAAE,EAAE,KAAK;YACT,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QAC1B,QAAQ,CAAC,uBAAuB,EAAE;YAChC,GAAG;YACH,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,EAAE,EAAE,KAAK;YACT,YAAY,EAAE,6BAA6B;SAC5C,CAAC,CAAC;QACH,MAAM,IAAI,kBAAkB,CAAC,4DAA4D,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IAED,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAGH;IAFrB,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,YAA6B,aAAqB,SAAS;QAA9B,eAAU,GAAV,UAAU,CAAoB;IAAG,CAAC;IAE/D,QAAQ,CAAC,UAAkB;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,GAAG,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;IACxD,CAAC;IAED,mEAAmE;IACnE,eAAe,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO;YACL,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,UAAkB,EAAE,OAAgC;QACtD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3C,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,UAAU,CAAC,UAAkB;QAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,CAAC;CACF;AAED,IAAI,mBAAmB,GAAiC,IAAI,CAAC;AAE7D,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/server-factory.d.ts

@@ -0,0 +1,8 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { TenantRuntime } from "./tenant-runtime.js";
+export type RuntimeResolver = (extra?: {
+    authInfo?: unknown;
+} | undefined) => Promise<TenantRuntime>;
+export declare function attachPqcToolHandlers(server: Server, resolveRuntime: RuntimeResolver): void;
+export declare function createPqcMcpServer(resolveRuntime: RuntimeResolver): Server;
+//# sourceMappingURL=server-factory.d.ts.map

package/dist/server-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-factory.d.ts","sourceRoot":"","sources":["../src/server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAMnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,MAAM,eAAe,GAAG,CAC5B,KAAK,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,KACvC,OAAO,CAAC,aAAa,CAAC,CAAC;AAI5B,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,eAAe,GAC9B,IAAI,CAkBN;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,eAAe,GAAG,MAAM,CAO1E"}

package/dist/server-factory.js

@@ -0,0 +1,29 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { buildToolList } from "./tool-definitions.js";
+import { invokeTool } from "./tool-dispatch.js";
+const tools = buildToolList();
+export function attachPqcToolHandlers(server, resolveRuntime) {
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+        const { name, arguments: args } = request.params;
+        try {
+            const rtx = await resolveRuntime(extra);
+            return await invokeTool(name, args, rtx);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Unknown error occurred";
+            console.error(`[pqc-memory] Tool ${name} failed:`, error);
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    });
+}
+export function createPqcMcpServer(resolveRuntime) {
+    const server = new Server({ name: "pqc-memory", version: "1.0.0" }, { capabilities: { tools: {} } });
+    attachPqcToolHandlers(server, resolveRuntime);
+    return server;
+}
+//# sourceMappingURL=server-factory.js.map

package/dist/server-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-factory.js","sourceRoot":"","sources":["../src/server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAMhD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;AAE9B,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,cAA+B;IAE/B,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBACtD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,cAA+B;IAChE,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IACF,qBAAqB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC"}